Currently, use of gpg is hardcoded. Instead, it ought to check whether a user has the config key gpg.program set, and use it if so. If not, it can fall back on a default.